c92a437da0fa542a5beae158cabf679b
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2025-Jun-11 00:25:37 |
| Debug artifacts |
M1Helper.pdb
|
| Comments | |
| CompanyName | IC客栈 |
| FileDescription | M1Helper |
| FileVersion | 3.0.0.0 |
| InternalName | M1Helper.exe |
| LegalCopyright | Copyright © www.ickezhan.com |
| LegalTrademarks | |
| OriginalFilename | M1Helper.exe |
| ProductName | M1Helper |
| ProductVersion | 3.0.0.0 |
| Assembly Version | 3.0.0.0 |
Plugin Output
| Info | Matching compiler(s): | Microsoft Visual C# v7.0 / Basic .NET |
| Info | Interesting strings found in the binary: |
Contains domain names:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to MD5 |
| Malicious | VirusTotal score: 39/72 (Scanned on 2025-12-29 12:38:16) |
ALYac:
Gen:Variant.Lazy.639785
AVG: Win32:MalwareX-gen [Misc] AhnLab-V3: Trojan/Win.Generic.C5651522 Arcabit: Trojan.Lazy.D9C329 Avast: Win32:MalwareX-gen [Misc] BitDefender: Gen:Variant.Lazy.639785 Bkav: W32.AIDetectMalware.CS CAT-QuickHeal: Trojan.Ghanarava.1764402195bf679b CTX: exe.trojan.sdum CrowdStrike: win/malicious_confidence_100% (W) Cylance: Unsafe DeepInstinct: MALICIOUS DrWeb: Trojan.DownLoader12.26361 Emsisoft: Gen:Variant.Lazy.639785 (B) Fortinet: PossibleThreat GData: Gen:Variant.Lazy.639785 Google: Detected Kaspersky: VHO:Trojan.Win32.Sdum.gen Kingsoft: Win32.Trojan.Sdum.gen Lionic: Trojan.Win32.Sdum.4!c Malwarebytes: Malware.AI.3949269983 McAfeeD: ti!235FACAD84FF MicroWorld-eScan: Gen:Variant.Lazy.639785 Microsoft: Trojan:Win32/Wacatac.B!ml Paloalto: generic.ml Panda: Trj/Chgt.AD Rising: Trojan.Sdum!8.1155F (CLOUD) Sangfor: Trojan.Win32.Sdum.V14j Skyhigh: GenericRXWI-VL!C92A437DA0FA Sophos: Mal/Generic-S Symantec: ML.Attribute.HighConfidence TrellixENS: GenericRXWI-VL!C92A437DA0FA TrendMicro: TROJ_GEN.R023C0PFR25 TrendMicro-HouseCall: TROJ_GEN.R023C0PFR25 VIPRE: Gen:Variant.Lazy.639785 Varist: W32/ABTrojan.IQTC-7197 ViRobot: Trojan.Win.Z.Zusy.2497536 Zillya: Trojan.Sdum.Win32.36049 alibabacloud: Trojan:Win/Wacatac.B9nj |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2025-Jun-11 00:25:37 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 48.0 |
| SizeOfCode | 0x25ee00 |
| SizeOfInitializedData | 0x2c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00260D8E (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x262000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x268000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 15 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
32512
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 3.0.0.0 |
| ProductVersion | 3.0.0.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | IC客栈 |
| FileDescription | M1Helper |
| FileVersion (#2) | 3.0.0.0 |
| InternalName | M1Helper.exe |
| LegalCopyright | Copyright © www.ickezhan.com |
| LegalTrademarks | |
| OriginalFilename | M1Helper.exe |
| ProductName | M1Helper |
| ProductVersion (#2) | 3.0.0.0 |
| Assembly Version | 3.0.0.0 |
| Resource LangID | UNKNOWN |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| SizeofData | 37 |
| AddressOfRawData | 0x260d11 |
| PointerToRawData | 0x25ef11 |
| Referenced File | M1Helper.pdb |